usb: xhci: Fix NULL pointer dereference as part of queue
In the scatter gather list handling as part of queuing
on the bulk endpoints in host mode, there is a possible
case where sent_len and block_len both are zero for
non-zero number of num_sgs. This will cause the num_sgs
to loop around zero and become a non-zero value and access
sg_next for the last SG which has SG_END set leading to
NULL pointer dereference.
Fix this by accessing the properties of SG after
the NULL check.
Change-Id: Ie9c64844fd04c5e2ef5ee53d1583bf9b998649fa
Signed-off-by:
Sriharsha Allenki <sallenki@codeaurora.org>
Loading
Please register or sign in to comment